[Honeywall] hflow process has died

[Emre Yuce]

Hi again,

I have searched why mysql is not working, and why I could not even 
started mysqld, looked at the logs at /var/log/mysqld.log . I have seen 
the error not enough available space left. I have looked the available 
space by `df` and there was no available space left under /var/ 
directory. While mysqld is starting, it tries to write under /var/ . So 
it was not started, yet hflow needs mysqld, hflow could not be started 
either.

Now I got backup of some files under /var and created some available 
space, rebooted the machine, then restarted honeywall processes from 
walleye gui ( while mysqld could not be started, I could not reach the 
walleye web gui).

Now my honeywall is working fine =)

Thanks to all,
Emre

Emre Yuce wrote:
> I have changed the error message. I have looked inside the 
> /etc/init.d/hflow , and seen the actual command executed is as below:
>
> /usr/bin/hflow -D -i ${HwLAN_IFACE} -p ${PIDFILE} -d 1 -n 
> ${LOCAL_NET_ADDR} -b ${LOCAL_NET_BITS} -s ${HwSENSOR_ID} -z _hflow -L 
> ${LOG_DIR}    ${SEBEK_PARMS}
>
> I have filled the variables with my own parameters, I got the same 
> error as expected. Then I have removed the -D option (for not running 
> in daemon mode, am I right?), and got the following error message:
>
> start of snort block_init
> failed to connect to database .. exiting
> : No such file or directory
>
> Thanks,
> Emre
>
>
> Emre Yuce wrote:
>> I have managed to get the same error as in the ticket 53 at last 
>> successfully :-s
>>
>> Starting hflowHflow: premature failure. Initialization aborted?
>> Parent sighandler, something  Received, exiting!
>>
>> I have opened the walleye web gui, but I could not login this 
>> morning. I have rebooted the machine from console. Tataam now I have 
>> the same error message.
>>
>> I suppose snort-inline does not miss any packages while hflow is not 
>> working.  AFAIK hflow saves the data to mysql. But does data go to 
>> snort over hflow?
>>
>> NOTE: I have changed /etc/oinkmaster.conf , i have uncommented the 
>> related line with the url of the rules by adding my oinkmaster code, 
>> but I do not think this has had an effect  ?!
>>
>> Thanks,
>> Emre
>>
>> Rob McMillen wrote:
>>> Are there any error messages from the restart that may indicate the
>>> real issue for the failure?
>>>
>>> Rob
>>>
>>> On Tue, Mar 31, 2009 at 6:42 PM, Dave <dave at six66.clara.co.uk> wrote:
>>>  
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> Hi,
>>>>
>>>> I too have this problem.
>>>> running: "services hflow restart"  from the terminal as root is more
>>>> effective at restarting hflow than using the walleye web gui.
>>>>
>>>> usually restarts after 2 or 3 attempts
>>>>
>>>> Dave
>>>>
>>>>
>>>>
>>>>
>>>> Emre Yuce wrote:
>>>>   
>>>>> Hi,
>>>>>
>>>>> I have installed roo1.4. After working a while hflow process has
>>>>> died 2 times. I have found some solutions that says making yum
>>>>> update solves the problem, but the system is already up to date.
>>>>>
>>>>> When hflow process dies, as expected I couldn't reach the data from
>>>>> the walleye.
>>>>>
>>>>> There is a similar ticket here:
>>>>> https://projects.honeynet.org/honeywall/ticket/53
>>>>>
>>>>> Thanks,
>>>>> Emre
>>>>> _______________________________________________
>>>>> Honeywall mailing list
>>>>> Honeywall at public.honeynet.org
>>>>> https://public.honeynet.org/mailman/listinfo/honeywall
>>>>>
>>>>>
>>>>>       
>>>> -----BEGIN PGP SIGNATURE-----
>>>> Version: GnuPG v1.4.2 (MingW32)
>>>> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>>>>
>>>> iD8DBQFJ0pw8gqrGK22a87ARAl85AJ9xZniDcY1c8FoW96962llh5QbINACeJhGE
>>>> POeiTiPyOx95XPUNoXe1+UU=
>>>> =8MsN
>>>> -----END PGP SIGNATURE-----
>>>>
>>>> _______________________________________________
>>>> Honeywall mailing list
>>>> Honeywall at public.honeynet.org
>>>> https://public.honeynet.org/mailman/listinfo/honeywall
>>>>
>>>>     
>>> _______________________________________________
>>> Honeywall mailing list
>>> Honeywall at public.honeynet.org
>>> https://public.honeynet.org/mailman/listinfo/honeywall
>>>
>>>   
>>
>> _______________________________________________
>> Honeywall mailing list
>> Honeywall at public.honeynet.org
>> https://public.honeynet.org/mailman/listinfo/honeywall
>>
>
> _______________________________________________
> Honeywall mailing list
> Honeywall at public.honeynet.org
> https://public.honeynet.org/mailman/listinfo/honeywall
>